An invalid pointer in the DOM Notifications component triggers undefined behavior, which can cause Firefox and Thunderbird to crash or behave unpredictably when handling notifications. This flaw is a form of invalid pointer dereference, classified as CWE-665 and CWE-824, and exposes a denial‑of‑service risk, allowing an attacker to prevent the user from using the affected applications normally.

Mozilla Firefox and Mozilla Thunderbird releases older than version 158 are vulnerable; the fix was applied in Firefox 158 and Thunderbird 158. All builds prior to those releases are considered at risk.

The CVSS score is 9.8; the EPSS score is < 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The likely attack vector is inferred to be a malicious web page that invokes the Notifications API, forcing the vulnerable component to dereference the invalid pointer. Because the flaw resides in the browser’s core engine, exploitation could potentially affect large numbers of users running outdated Firefox or Thunderbird releases.